# Vulnerability management

URL: /systems/trust-and-governance/controls/vulnerability-management · Id: `control:vulnerability-management`

> Every dependency and running Version is scanned daily, and each known vulnerability is fixed within its severity deadline.

Every dependency and running [Version](/business/nouns/version) is scanned daily, and each known vulnerability is fixed within its severity deadline.

## Satisfies
| Criterion | Text |
| --- | --- |
| [SOC2 CC7.1](/systems/trust-and-governance/criteria/soc2/cc7-1) | The entity uses detection and monitoring to identify configuration changes and newly discovered vulnerabilities. |
| [ISO27001 A.8.8](/systems/trust-and-governance/criteria/iso27001/a-8-8) | Information about technical vulnerabilities is obtained, exposure is evaluated, and measures are taken. |

## Implemented by
- [Security](/workflows/processes/security)
- [Release](/workflows/processes/release)
- [Repositories](/code/systems/repositories)

## Test
| Step | Rule |
| --- | --- |
| Kind | Detective: it finds the failure after it happens. |
| Select | Every vulnerability the daily scan finds in the report period. |
| Assert | Each closed through a merged Change within its severity deadline, or through a Decision accepting the risk. |

## Owner
[Security Engineer](/agents/engineering/security-engineer), [Engineering Team](/agents/engineering).

## Example
Daily scanning finds a high-severity flaw in an invoice-parsing API's PDF library. A merged [Change](/business/nouns/change) upgrades it in 3 days, inside the 7-day deadline.